I discovered a browser bug

#1

Post by brie22 » Thu, Jun 21, 2018, 12:26 PM UTC

I discovered a browser bug
jakearchibald.com

Re: I discovered a browser bug

#2

Post by obl » Thu, Jun 21, 2018, 1:04 PM UTC

It's quite incredible how the web managed to get along with such a janky sandbox model.

It's a very important thing that users trust their browser and won't hesitate a second to enter an unknown URL. They see "going to a webpage" as the equivalent to looking at a poster in the street, not eating candy provided by a random stranger.

Eroding this trust would ruin it for everyone, even well behaved static websites without javascript.

Maybe it's time to reconsider giving the same execution rights to gmail and unknown web pages ?

Re: I discovered a browser bug

#3

Post by dannyw » Thu, Jun 21, 2018, 1:10 PM UTC

This was such a nasty bug for Edge. Visiting any page means I could now read your private Messenger messages, or your email. You could even automate resetting the password to an account, and then automatically exfiltrating the URL!

Re: I discovered a browser bug

#4

Post by simion314 » Thu, Jun 21, 2018, 1:13 PM UTC

obl wrote: post #2

It's quite incredible how the web managed to get along with such a janky sandbox model. It's a very important thing that users trust their browser and won't hesitate a second to enter an unknown URL. They see "going to a webpage" as the equivalent to looking at a poster in the street, not eating candy provided by a random stranger. Eroding this trust would ruin it for everyone, even well behaved static websites witho…

I use a private window for banking/paypal , I don't trust the extensions or the other tabs so for this cases I get more security.

Re: I discovered a browser bug

#5

Post by tzahola » Thu, Jun 21, 2018, 1:14 PM UTC

obl wrote: post #2

It's quite incredible how the web managed to get along with such a janky sandbox model. It's a very important thing that users trust their browser and won't hesitate a second to enter an unknown URL. They see "going to a webpage" as the equivalent to looking at a poster in the street, not eating candy provided by a random stranger. Eroding this trust would ruin it for everyone, even well behaved static websites witho…

Sorry, but we need a Turing-complete language for ads and tracking.

Preferably with JITting, and unfettered access to the GPU and other misc. peripherals like GPS, webcam, etc. In return you get free cat videos.

You’re welcome.

Re: I discovered a browser bug

#6

Post by WorkLifeBalance » Thu, Jun 21, 2018, 1:17 PM UTC

obl wrote: post #2

It's quite incredible how the web managed to get along with such a janky sandbox model. It's a very important thing that users trust their browser and won't hesitate a second to enter an unknown URL. They see "going to a webpage" as the equivalent to looking at a poster in the street, not eating candy provided by a random stranger. Eroding this trust would ruin it for everyone, even well behaved static websites witho…

Do you want to reinforce established monopolies? Because I can't think of a better way of doing that than having a technical difference between "trusted" and "untrusted" sites.

Re: I discovered a browser bug

#7

Post by acdha » Thu, Jun 21, 2018, 1:18 PM UTC

The Microsoft experience reminded me of the time when security@apple.com went to the building security office, who just quietly deleted bug reports. Poor processes amd communication is one of the worst classes of security problem.

Re: I discovered a browser bug

#8

Post by Promarged » Thu, Jun 21, 2018, 1:22 PM UTC

> Oh, I guess the vulnerability needs an extremely tenuous name and logo right? Here goes

I admire the extra touch here :)

Re: I discovered a browser bug

#9

Post by yoz-y » Thu, Jun 21, 2018, 1:22 PM UTC

WorkLifeBalance wrote: post #6

obl wrote: post #2

It's quite incredible how the web managed to get along with such a janky sandbox model. It's a very important thing that users trust their browser and won't hesitate a second to enter an unknown URL. They see "going to a webpage" as the equivalent to looking at a poster in the street, not eating candy provided by a random stranger. Eroding this trust would ruin it for everyone, even well behaved static websites witho…

Do you want to reinforce established monopolies? Because I can't think of a better way of doing that than having a technical difference between "trusted" and "untrusted" sites.

What about differentiating applications and web sites? The line between the two is blurry, I know, but I would be happy if the document metaphor were divorced from the application one.

Re: I discovered a browser bug

#10

Post by munin » Thu, Jun 21, 2018, 1:24 PM UTC

acdha wrote: post #7

The Microsoft experience reminded me of the time when security@apple.com went to the building security office, who just quietly deleted bug reports. Poor processes amd communication is one of the worst classes of security problem.

Microsoft used to have a group, Trustworthy Computing (TWC), that was where all the security expertise lived. TWC was destroyed in 2014. From the outside, it seemed like that was the point where the reporter/outside security engagement story stopped, because the people that held responsibility for it Microsoft wide were either fired or re-orged into a role where they didn't have broad authority any more. Now, you get stuff like this, where people on the "security" group (which is squirreled away in a totally different part of Microsoft) don't have visibility into the Edge bug tracker any more.

Internally, Microsoft is organized a lot like the Federal government, only worse.